thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

EC-Council · Cybersecurity · Associate

EC-Council Certified SOC Analyst (CSA) exam guide

Exam 312-39

Certified SOC Analyst (CSA) validates Tier 1-2 security operations skills: log management, SIEM detection, triage, threat hunting and incident response. It is a practical-minded entry credential for analysts moving into a security operations center.

Questions100
Time limit180 minutes
Passing score70%
Exam feeSee official page
Valid for3 years
DeliveryEC-Council Exam Portal (remote proctored) or ECC test centers

Format: Multiple choice. Fee note: Sold with training that includes the exam voucher: from $999 on-demand or $1,399 live online.

Who it's for

New and junior SOC analysts, network or system administrators moving into security monitoring, and Security+ holders seeking a SOC-specific credential.

What the exam covers

Security Operations and Management—
Understanding Cyber Threats, IoCs, and Attack Methodology—
Log Management—
Incident Detection and Triage—
Proactive Threat Detection—
Incident Response—
Forensic Investigation and Malware Analysis—
SOC for Cloud Environments—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: No formal prerequisite; EC-Council requires the official training to earn the credential.

Recommended: Networking and TCP/IP knowledge plus familiarity with firewalls, IDS/IPS and common threats.

Keeping it active

Valid three years under EC-Council's ECE policy: earn 120 ECE credits in the cycle and pay the $80 annual continuing education fee.

Skills & careers

Skills it validates

  • Collecting and analysing logs
  • Writing and tuning SIEM use cases
  • Alert triage and escalation
  • Identifying indicators of compromise
  • Basic threat hunting
  • Incident response procedures
  • Cloud SOC monitoring

Job roles

SOC Analyst (Tier 1/2)Security Monitoring AnalystIncident Response AnalystCybersecurity AnalystThreat Detection Analyst

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Cover SOC operations, threats and IoCs, and log management modules.
  2. Week 3: Practise SIEM searches and correlation rules in the labs or a free Splunk/Elastic instance.
  3. Week 4: Study detection, triage and incident response modules.
  4. Week 5: Take practice tests, review weak modules, and book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know Windows event IDs and common log sources; they appear in scenario questions.
  • Understand the difference between events, alerts and incidents in EC-Council terms.
  • 100 questions in 3 hours gives under 2 minutes each; flag and move on.
  • Review SOC metrics such as MTTD and MTTR.

Key terms for this exam

All 24 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does CSA cost?

It is sold with training; packages start at $999 including the exam voucher.

How many questions are on 312-39?

100 multiple-choice questions in 3 hours; 70% to pass.

Is CSA worth it?

It is a reasonable SOC-specific add-on to Security+; CySA+ is more widely requested in job postings.

CSA vs CySA+?

CSA is SOC-workflow focused; CySA+ is broader and includes performance-based questions.

Does CSA expire?

Yes, three years, renewed through 120 ECE credits and annual fees.

Official page: www.eccouncil.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.